| #496 |
Race: Workflow definition hash collision
api/blueprints/v1/workflows.py:236-256 - Concurrent submissions of same workflow can fail. FIX: Use ...
|
closed |
medium |
2025-12-17 02:57 |
- |
|
| #495 |
Race: App installation duplicate
api/blueprints/v1/tenant_apps.py:174-200 - TOCTOU in SELECT-then-INSERT. Concurrent installs cause 5...
|
closed |
medium |
2025-12-17 02:57 |
- |
|
| #494 |
Race: Signal duplicate send without idempotency
api/blueprints/v1/signals.py:33-64 - Concurrent POST /signals can create duplicate signals. FIX: Add...
|
closed |
medium |
2025-12-17 02:57 |
- |
|
| #489 |
Memory: Vault cache expired entries never proactively removed
engine/config.py:82 - _vault_cache entries checked on read but expired entries never proactively cle...
|
closed |
medium |
2025-12-17 02:25 |
- |
|
| #486 |
Performance: Inefficient double iteration in secret_manager cache eviction
engine/services/secret_manager.py:342 - List comprehension extracts keys from already-converted list...
|
closed |
medium |
2025-12-17 02:25 |
- |
|
| #485 |
Performance: Unnecessary list() in activity_worker futures
engine/services/activity_worker.py:605 - list(futures_snapshot.items()) on already-snapshotted dict....
|
closed |
medium |
2025-12-17 02:25 |
- |
|
| #484 |
Performance: Unnecessary list() in db.py singleton cleanup
engine/db.py:532 - list(SingletonMeta._instances.values()) when no modification during iteration. FI...
|
closed |
medium |
2025-12-17 02:25 |
- |
|
| #483 |
Race Condition: SidecarTelemetry __init__ attribute race
engine/sidecar_telemetry.py:74-90 - Singleton __init__ called every time. _initialized check not ato...
|
closed |
medium |
2025-12-17 02:25 |
- |
|
| #482 |
Performance: Regex not pre-compiled in durable_context.py
engine/durable_context.py:1621 - Regex pattern compiled inline. FIX: Pre-compile at module level.
|
closed |
medium |
2025-12-17 02:25 |
- |
|
| #479 |
Performance: Inefficient last-key access with tuple(dict.keys())[-1]
engine/interpreters/inline_executor.py:690,893
Getting last key via tuple conversion is inefficient...
|
closed |
medium |
2025-12-17 01:42 |
- |
|
| #477 |
Memory Leak: Tool registry never cleaned
engine/tools/registry.py:103-104
ToolRegistry._tools dict grows unbounded:
- App tools added dynami...
|
closed |
medium |
2025-12-17 01:42 |
- |
|
| #476 |
Race Condition: Cache eviction KeyError in activity_worker and config
engine/services/activity_worker.py:105-126
engine/config.py:632-644
Cache eviction can raise KeyErr...
|
closed |
medium |
2025-12-17 01:42 |
- |
|
| #475 |
Race Condition: File deduplication missing ON CONFLICT
engine/services/storage_service.py:114-131
File store deduplication has TOCTOU race:
1. Store file ...
|
closed |
medium |
2025-12-17 01:42 |
- |
|
| #470 |
Code Quality: Module constant lists should be tuples for immutability
Three module-level constants are defined as lists but never modified. Should be tuples:
1. engine/s...
|
closed |
medium |
2025-12-17 01:11 |
- |
|
| #468 |
Performance: Regex compiled on every call in operators.py and variable_resolver.py
Multiple hot-path functions compile regex patterns on every call instead of once:
1. engine/interpr...
|
closed |
medium |
2025-12-17 01:11 |
- |
|
| #467 |
Race Condition: notification_count increment without lock in activity_worker.py
engine/services/activity_worker.py:252-254 increments notification_count without synchronization.
I...
|
closed |
medium |
2025-12-17 01:11 |
- |
|
| #466 |
Race Condition: _last_cache_check_time modified without lock in http_request.py
engine/tools/http_request.py:209-231 modifies module-level _last_cache_check_time without synchroniz...
|
closed |
medium |
2025-12-17 01:11 |
- |
|
| #464 |
Memory Leak: Unbounded _secret_managers in secret_manager.py
engine/services/secret_manager.py:287,304-308 has unbounded _secret_managers dict.
Each unique conf...
|
closed |
medium |
2025-12-17 01:11 |
- |
|
| #460 |
MEDIUM: Performance bottlenecks in hot paths
1. N+1 activity queries (activity_logger.py:519) - HIGH
2. O(N²) variable lookups in loops (inline_e...
|
closed |
medium |
2025-12-17 00:17 |
- |
|
| #458 |
MEDIUM: TOCTOU race conditions in DB operations
Check-then-act patterns without atomicity:
1. S3 deduplication (storage/s3_provider.py:169-178)
2. W...
|
closed |
medium |
2025-12-17 00:17 |
- |
|